7.8
CVSSv3

CVE-2016-4997

Published: 03/07/2016 Updated: 12/09/2023
CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
VMScore: 730
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Summary

The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel prior to 4.6.3 allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

linux linux kernel

canonical ubuntu linux 12.04

canonical ubuntu linux 16.04

canonical ubuntu linux 15.10

canonical ubuntu linux 14.04

novell suse linux enterprise module for public cloud 12.0

novell suse linux enterprise server 12.0

novell suse linux enterprise live patching 12.0

novell suse linux enterprise desktop 12.0

novell suse linux enterprise real time extension 12.0

novell suse linux enterprise workstation extension 12.0

novell suse linux enterprise software development kit 12.0

oracle linux 7

debian debian linux 8.0

Vendor Advisories

Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel-rt is now available for Red Hat Enterprise MRG 25Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (C ...
Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (C ...
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks CVE-2015-7515, CVE-2016-2184, CVE-2016-2185, CVE-2016-2186, CVE-2016-2187, CVE-2016-3136, CVE-2016-3137, CVE-2016-3138, CVE-2016-3140 Ralf Spenneberg of OpenSource Sec ...
A flaw was discovered in processing setsockopt for 32 bit processes on 64 bit systems This flaw will allow attackers to alter arbitary kernel memory when unloading a kernel module This action is usually restricted to root-priveledged users but can also be leveraged if the kernel is compiled with CONFIG_USER_NS and CONFIG_NET_NS (CVE-2016-4997 ...
A flaw was discovered in processing setsockopt for 32 bit processes on 64 bit systems This flaw will allow attackers to alter arbitrary kernel memory when unloading a kernel module This action is usually restricted to root-privileged users but can also be leveraged if the kernel is compiled with CONFIG_USER_NS and CONFIG_NET_NS and the user is gr ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the Linux kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the Linux kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...

Exploits

# Exploit Title: Linux kernel <= 462 - Local Privileges Escalation via IP6T_SO_SET_REPLACE compat setsockopt call # Date: 2016108 # Exploit Author: Qian Zhang@MarvelTeam Qihoo 360 # Version: Linux kernel <= 462 # Tested on: Ubuntu 16041 LTS Linux 440-21-generic # CVE: CVE-2016-4997 # Reference:wwwopenwallcom/lists/oss-secur ...
## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## require "msf/core" class MetasploitModule < Msf::Exploit::Local Rank = GoodRanking include Msf::Post::File include Msf::Exploit::EXE include Msf::Exploit::FileDropper def initialize(info = {}) ...
This Metasploit module attempts to exploit a netfilter bug on Linux Kernels before 463, and currently only works against Ubuntu 1604 (not 16041) with kernel 440-21-generic Several conditions have to be met for successful exploitation ...
This Metasploit module attempts to exploit a netfilter bug on Linux Kernels befoe 463, and currently only works against Ubuntu 1604 (not 16041) with kernel 440-21-generic Several conditions have to be met for successful exploitation: Ubuntu: 1 ip_tablesko (ubuntu), iptable_raw (fedora) has to be loaded (root running iptables -L will do su ...

References

CWE-264http://www.openwall.com/lists/oss-security/2016/06/24/5http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce683e5f9d045e5d67d1312a42b359cb2ab2a13chttp://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.3https://github.com/torvalds/linux/commit/ce683e5f9d045e5d67d1312a42b359cb2ab2a13chttps://bugzilla.redhat.com/show_bug.cgi?id=1349722http://www.ubuntu.com/usn/USN-3017-2http://www.ubuntu.com/usn/USN-3018-2http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00061.htmlhttp://www.ubuntu.com/usn/USN-3016-4http://www.ubuntu.com/usn/USN-3016-1http://www.ubuntu.com/usn/USN-3016-2http://www.ubuntu.com/usn/USN-3016-3http://www.ubuntu.com/usn/USN-3018-1http://www.ubuntu.com/usn/USN-3019-1http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00060.htmlhttp://www.ubuntu.com/usn/USN-3017-3http://www.ubuntu.com/usn/USN-3020-1http://www.ubuntu.com/usn/USN-3017-1http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlhttp://www.openwall.com/lists/oss-security/2016/09/29/10https://github.com/nccgroup/TriforceLinuxSyscallFuzzer/tree/master/crash_reports/report_compatIpthttp://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00054.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00052.htmlhttp://www.debian.org/security/2016/dsa-3607http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00051.htmlhttp://www.securitytracker.com/id/1036171http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.htmlhttp://www.securityfocus.com/bid/91451http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00053.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00048.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00050.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00027.htmlhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05347541https://www.exploit-db.com/exploits/40489/https://www.exploit-db.com/exploits/40435/http://rhn.redhat.com/errata/RHSA-2016-1883.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1875.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1847.htmlhttps://access.redhat.com/errata/RHSA-2016:1883https://nvd.nist.govhttps://www.exploit-db.com/exploits/40489/https://usn.ubuntu.com/3018-2/https://www.debian.org/security/./dsa-3607